Start here: what this blog is for

Most fields have an obvious way in. You find the standard textbook, the well worn certification path, a few good blogs, and a community that has been arguing about the same problems long enough to have produced decent explanations.

AI governance, risk, compliance and security does not have that yet.

Why it is hard to start

The regulations are new. The EU AI Act entered into force in 2024 with obligations phasing in over several years. The Cyber Resilience Act is on a similar path. Practice is being invented while the deadlines approach, so there is no settled body of experience to learn from.

The standards cost money. ISO/IEC 42001 and ISO/IEC 27001 are the reference points for AI management systems and information security, and both sit behind paywalls that run to hundreds of euros. Someone exploring whether this field suits them is unlikely to buy a copy first.

Most available writing is not written to teach. It is vendor content aimed at buyers, or legal analysis aimed at lawyers. Both have their place. Neither helps an engineer who has been told the model they shipped is now in scope and has a fortnight to work out what that means.

The vocabulary is a barrier before the concepts are. Conformity assessment, substantial modification, technical documentation, statement of applicability. None of these are hard ideas. All of them are opaque until somebody translates them once.

What this blog will do

Work through things in the open, and be specific about what is settled and what is not.

Concretely, that means posts on how particular obligations map to work you actually do, what the mandatory documents for a given framework really are and what goes in them, where requirements from different frameworks overlap so you can do the work once, and where practice has not yet caught up with the text.

Where I am uncertain, I would rather say so than write around it. A confident answer that turns out to be wrong is worse than no answer, particularly in a field where people may act on it.

What it will not do

It will not tell you a tool makes you compliant. It will not reproduce standards text that is not mine to reproduce. It will not present clause references as authoritative when I have inferred them rather than verified them against the source, and I will say which is which.

If you are starting out

The single most useful thing to understand early is that AI GRCS is not one discipline. It is the overlap of several: information security, data protection, product safety, quality management, and increasingly product liability. People arrive from one of those and assume the others are details. They are not, and the gaps between them are where most real problems live.

More on that soon. If it is useful, subscribe and it will reach you.